Overview

overview

10

Static

static

10

a40cc8486a...5d.exe

windows7-x64

10

a40cc8486a...5d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a40cc8486acef7c0969f25d913a67d6da824bb97ef9ebf48ddfe1835663af65d

  • Size

    73KB

  • Sample

    250327-ym5tqaxtf1

  • MD5

    d5da1e536afdda256c6b6174c4bcd705

  • SHA1

    374dfb66e77aa5b8ad43994d587b6b58a6ccbfd7

  • SHA256

    a40cc8486acef7c0969f25d913a67d6da824bb97ef9ebf48ddfe1835663af65d

  • SHA512

    77817afe1308ff0109e284faadc1a43bb17223bb43c2e12c801d753ac9b607a3a8b464683e626ea3f1b82976a034ea0d29c2ad95bb20c39b40e184245ee3b105

  • SSDEEP

    1536:sUPQcxjTbCKGPMVme9VdQkhDIyH1bf/RmQQzcX3VclN:sUYcxjXZGPMVme9VdQgH1bfZmQQilY

Score
10/10
asyncratvenomratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

Mutex

hahahahhaa

Attributes
  • delay

    10

  • install

    true

  • install_file

    keycheese.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/LwwcrLg4

aes.plain

Targets

    • Target

      a40cc8486acef7c0969f25d913a67d6da824bb97ef9ebf48ddfe1835663af65d

    • Size

      73KB

    • MD5

      d5da1e536afdda256c6b6174c4bcd705

    • SHA1

      374dfb66e77aa5b8ad43994d587b6b58a6ccbfd7

    • SHA256

      a40cc8486acef7c0969f25d913a67d6da824bb97ef9ebf48ddfe1835663af65d

    • SHA512

      77817afe1308ff0109e284faadc1a43bb17223bb43c2e12c801d753ac9b607a3a8b464683e626ea3f1b82976a034ea0d29c2ad95bb20c39b40e184245ee3b105

    • SSDEEP

      1536:sUPQcxjTbCKGPMVme9VdQkhDIyH1bf/RmQQzcX3VclN:sUYcxjXZGPMVme9VdQgH1bfZmQQilY

    Score
    10/10
    asyncratvenomratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • VenomRAT

      Detects VenomRAT.

      rat

    • Venomrat family

      venomrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks